This week's bulletin collects fifteen separate stories rather than one incident, and the common thread is that each one touches software your team already trusts. A Qilin ransomware suspect was extradited, malicious VS Code themes stayed live on the Visual Studio Marketplace, and a RAT arrived through WhatsApp disguised as a financial statement. Details in this article come from analysis published by The Hacker News.

On the law enforcement side, a 28-year-old Russian national believed to be a core Qilin member was detained in Osaka in May and handed to German authorities on October 2, 2026. He is wanted for breaking into a logistics company in September 2024, encrypting its systems, and extorting more than $160,000 in cryptocurrency. Separately, a Russian-speaking affiliate of the Gentlemen ransomware operation, going by Azazel, hit two dozen victims across six countries and then published the stolen data on his own site, Leakned, keeping the extortion proceeds instead of routing them through the program.

The malware items run in parallel. VulcanRAT207 arrives as "Statement.exe" over WhatsApp, then uses a signed GoFly driver (GoFly64.sys) to terminate Baidu security processes before launching a WebSocket remote access trojan. Socket tied two live marketplace themes, Coca-Cola Christmas and Aurora Borealis Studio Theme, to the removed Aurora Nocturne Night Theme and to GlassWorm activity, with a Cosmic Nebula Themes build using Solana transaction memos to locate follow-on payload infrastructure.

Group-IB and Hunt.io traced BraZetsu, a Python-based Windows framework sold through an underground market that lists compromised hosts for roughly $5.80 per access, back to C2 infrastructure that was serving TLS almost five months before public disclosure.

Taken together, these are independent campaigns converging on the same four places: developer tooling, messaging apps, remote access software, and endpoint drivers. The sections that follow break down how each chain works and what the activity means for the systems you run.

Inside the Qilin Affiliate Dispute and What Exposed Tooling Reveals

The affiliate betrayal this week involves Gentlemen ransomware, not Qilin. A Russian-speaking affiliate using the handle Azazel hit two dozen victims across six countries, then published the stolen data on his own private leak site branded Leakned and collected the extortion payments directly instead of routing them through the Gentlemen program.

CloudSEK described it as a double betrayal, of the victims and of the ransomware-as-a-service operator running the panel. That detail matters for how you read attribution. In a RaaS model the brand supplies the encryptor, the negotiation portal and the leak site, and the affiliate supplies the intrusion. When an affiliate forks off and stands up his own leak infrastructure, the tradecraft stays identical while the branding on the extortion note changes.

So indicators tied to a ransomware family name have a short shelf life. The person who compromised the network keeps their tooling, their access brokers and their habits when they move to the next program, which means detection built around a brand rather than behavior stops working the moment an affiliate walks.

Operator-side mistakes gave researchers a second view into that behavior. An exposed staging server at 151.243.232[.]123 held 17 named post-exploitation tools, including credential-dumping scripts, saved Mimikatz output, SQL credential-testing utilities and file-transfer tooling, alongside traces of an intrusion into an environment linked to Mexican airline Viva Aerobus in late September 2026.

The access path ran through a Microsoft SQL server, where the actor used xp_cmdshell to execute commands and stage further payloads. Exfiltration was the interesting part. ThreatMon found tooling that reads a file, splits it into chunks, Base64-encodes the content and returns those chunks through MSSQL query output, so the data leaves over the existing database session with no separate outbound channel to flag.

ThreatMon also noted that unrelated internet hosts reached the exposed directory shortly after the first confirmed victim activity, which put both the tools and the already-collected victim material at risk of being picked up by third parties.

Hunt.io applied the same logic to BraZetsu, the Python-based Windows framework tied to the Infected Marketplace access shop, by pivoting on TLS certificates instead of waiting for malware samples.

"The command hostname reported on 31 August, c2.installscenter[.]com, was already serving TLS on a second VPS (80.78.27[.]252) on port 2083 from 4 April 2026, almost five months before the disclosure," Hunt.io said.

The same host also presents painel.installscenter[.]com on ports 8083 and 8443, putting the operator control panel and the C2 on one apex domain and one box. Infrastructure that predates public reporting by months is infrastructure that was already touching networks nobody had reason to look at yet.

On the intrusion side, the lures remain ordinary. A file named Statement.exe delivered over WhatsApp unpacks a loader that screens the host, attempts elevation, and uses PoolParty Variant 7 to inject a downloader into the LocalSystem Task Scheduler process without calling CreateRemoteThread. Morphisec reports the chain then loads a signed GoFly64.sys driver to kill selected Baidu security processes, a bring-your-own-vulnerable-driver step that disables protection using a legitimately signed component, before side-loading a Vulkan DLL to launch the WebSocket RAT.

Separately, Huntress tracked a phishing campaign first seen on September 10, 2026 that hosted fake reference documents on legitimate Power BI domains, fingerprinted visitors, then triggered a delayed download of a rogue ScreenConnect installer. Remote monitoring software gives an operator hands-on access that looks like normal IT administration in your logs.

VulcanRAT207, GlassWorm Theme Packages and Driver Abuse by Gentlemen Ransomware

The lure is a file named Statement.exe delivered over WhatsApp, dressed up as a financial document. Morphisec traced it to a multi-stage Windows intrusion ending in VulcanRAT207, a WebSocket-based remote access trojan. Delivery through a messaging client matters because the file never passes a mail gateway, so attachment sandboxing, link rewriting and sender authentication checks are not in the path at all.

After unpacking, the loader screens the host, attempts elevation, and injects a downloader into the LocalSystem Task Scheduler process. It does this using PoolParty Variant 7, an injection technique that abuses Windows thread pool structures and never calls CreateRemoteThread, which is the API most endpoint tools watch for cross-process injection (T1055). The practical effect is that malicious code runs under a trusted SYSTEM-level service rather than a suspicious standalone process.

The chain then pulls a deployment bundle and establishes persistence through a Vulkan DLL side-loading task (T1574.002), where a legitimate signed executable loads an attacker-supplied DLL from a path it trusts. Once resident, VulcanRAT207 collects system metadata, opens interactive shell access, enumerates local accounts, terminates security processes, replaces clipboard text and can terminate itself on command. Clipboard replacement is quiet and lucrative, since a copied payment or wallet address can be swapped in transit without the user noticing.

Driver abuse inside the same chain

The deployment bundle includes GoFly64.sys, a signed GoFly driver used to terminate selected Baidu security processes. This is bring-your-own-vulnerable-driver (BYOVD, T1562.001): the attacker installs a driver that carries a valid code-signing certificate, so Windows loads it into the kernel, then abuses a flaw in that driver to issue kernel-level process termination calls. Code running in the kernel sits above user-mode security agents, which is why the agent gets killed without an obvious tamper event.

For defenders the artifacts worth knowing are the driver filename itself, a new kernel service entry created shortly before security processes stop reporting, and the scheduled task tied to the Vulkan side-load. When an endpoint agent goes silent and the host stays online, driver load events are the place that story usually begins.

GlassWorm themes still on the marketplaces

Socket found two color themes still live on the Visual Studio Marketplace, Coca-Cola Christmas and Aurora Borealis Studio Theme, both sharing code lineage with Aurora Nocturne Night Theme, a previously removed extension that concealed an obfuscated Windows downloader. Six cluster-linked extension identities turned up in Open VSX, including Cosmic Nebula Themes.

The Marketplace build of Cosmic Nebula Themes carries a loader that decrypts and executes embedded JavaScript, skips systems with Russian language settings or Russian time zones, and uses Solana transaction memos as a dead drop resolver to find its follow-on payload infrastructure. Reading command-and-control addresses off a public blockchain means there is no domain to seize and no fixed IP to block. Socket researcher Kirill Boychenko noted the build reuses the same Solana address, AES key and execution model documented in earlier GlassWorm activity.

• Themes install silently from inside the IDE and inherit the developer's local permissions.
• A compromised workstation exposes source repositories, SSH keys, cloud credentials and package registry tokens.
• Those tokens let an attacker publish tainted versions of packages your customers already install, turning one laptop into a distribution channel.

That is the supply chain concern in plain terms: the initial victim is one engineer, and the downstream victims are everyone who trusts that engineer's published code.

Business Exposure Across Developer Workstations, Messaging and Remote Access

The npm package @subql/common version 5.8.3 shipped a hidden payload that collects credentials and opens remote shell access, and it runs both during installation and when the package is imported. StepSecurity noted it targets developer workstations and CI environments, including GitHub Actions runners and reachable cloud services. If that package landed in your build pipeline, the exposure is not one laptop. It is whatever tokens, deploy keys and cloud credentials your runners hold.

The nine npm packages published by the account "dirtyblanket" within 33 minutes on September 29, 2026 show how far that spreads. The embedded Linux worm installs a backdoor called systemd-fontd disguised as a font service, runs the open-source CHAOS remote access tool over Tor for shell access, file access and screenshots, then uses every SSH private key on the machine to log into hosts listed in known_hosts. It also uses npm tokens found locally to publish new versions of that developer's own packages.

That last step is the one your leadership should understand. A compromised engineer workstation becomes a publishing point, which means your company name goes on the poisoned release and your customers inherit the incident. SafeDep also documented 42 malicious RubyGems from the account "reqthrottle_3474" that stay silent in CI and sandboxes and wait 20 to 40 minutes on a real developer machine before opening a reverse shell or pulling a second-stage archive. Build-time scanning that looks clean tells you less than you think.

WhatsApp delivery changes your cost model for endpoint incidents. Messaging apps sit outside the mail gateway, so there is no quarantine record, no sender reputation data and no attachment detonation log to hand an investigator. On a BYOD or field-heavy workforce, you may not even be able to prove which device received the file, which lengthens the forensic phase and the legal review that follows it.

The Power BI campaign Huntress first observed on September 10, 2026 abused legitimate Microsoft domains to host a fake reference document, fingerprinted visitors on an attacker-controlled page, then triggered a delayed ScreenConnect installer download. Remote monitoring tools are the hardest abuse for a business to reason about, because the resulting sessions look exactly like your helpdesk working. Expect to spend real hours reconstructing which remote sessions were yours.

Driver-level tampering that terminates security processes matters mainly for timing. When endpoint protection is disabled before the encryption or exfiltration stage, the detection you paid for produces no alert during the window when intervention is cheapest, and your first indicator becomes a user complaint or a ransom note.

Two incidents this week carry direct notification consequences. A file upload flaw in recreation management software used by municipalities and parks let an attacker create an account, upload web shells across three servers and steal payment data, which pulls in card brand obligations alongside state breach notification law. Resecurity's yard management system findings, where a predictable identifier and a hard-coded signing secret allowed forged sessions for arbitrary accounts including privileged ones, produce access logs that look entirely legitimate.

Downtime remains the quieter cost. A former infrastructure engineer locked thousands of systems and servers at his employer and received a 32-month sentence, and the recovery work for that scale of lockout runs well past the day the attacker is identified. When extortion data surfaces outside the agreed channel, as it did in the affiliate dispute described earlier, your negotiation record can become public regardless of what was settled.

Detection and Hardening Actions for These Specific Threats

Start with your developer endpoints. Run code --list-extensions across workstations and build agents, and remove any instance of Coca-Cola Christmas, Aurora Borealis Studio Theme, or Cosmic Nebula Themes, including the Open VSX builds. Removal alone is not closure. Treat every machine that ran one of those themes as credential-exposed and rotate the npm tokens, SSH keys, cloud access keys and Git credentials stored on it.

Next, enable Microsoft's vulnerable driver blocklist and add a specific block or high-severity alert for GoFly64.sys. That signed driver is what the WhatsApp-delivered chain used to terminate selected Baidu security processes, and the same pattern applies to any security agent an attacker wants silenced. In environments Capstone manages, SentinelOne flags the endpoint-protection tampering step itself across managed environments, so the kill attempt surfaces as an alert even when the driver carries a valid signature.

Then inventory ScreenConnect. Pull every installed instance and match it against your sanctioned deployment list, because the Power BI phishing campaign Huntress observed from September 10, 2026 delivers a rogue installer from an attacker-controlled page after fingerprinting the victim. Anything unmatched is an active remote session into your network with someone else holding the console.

Over the next few weeks, close the delivery paths and the exfiltration paths:

• Restrict file transfer in WhatsApp Desktop on corporate endpoints, or block the client outright where there is no business case. Files delivered through a messaging client never touch your mail gateway, so attachment detonation and link rewriting are not in the path.
• Write EDR rules for unsigned executables launched from messaging application download directories, and alert on financial-sounding lure filenames such as Statement.exe executing from a user profile path.
• Alert on driver installation from user-writable directories, which is the staging behavior that precedes the driver load rather than the load itself.
• Disable xp_cmdshell on Microsoft SQL Server unless an application genuinely requires it. ThreatMon found an actor using it to run commands and return Base64-encoded file chunks through query output, meaning the data left through the database connection with no separate outbound channel to detect.
• Block outbound traffic to 45.138.12[.]177 on ports 8089, 8090 and 8092, the reverse shell and payload host behind the 42 malicious RubyGems packages.

Two application-layer items deserve a slot in your next sprint. Review session cookie design in any internally built or vendor-supplied web application, specifically checking that the signing secret is not hard-coded and that the signed value is a random session identifier rather than a public database ID. Resecurity found both weaknesses in one yard management system, and combined they let an attacker mint valid cookies for arbitrary accounts, including privileged ones. Separately, audit file upload functions for server-side type and content validation, since a flaw in exactly that function let an attacker self-register, upload web shells and steal payment data from three servers.

For the longer horizon, move developer tooling to an extension allowlist so a marketplace listing cannot install itself into your build environment on a developer's judgment call. Publish an RMM governance policy naming which remote access tools are approved, who may install them, and what alerting fires when an unapproved one appears. Finish with restore testing from offline copies, verified by actually recovering data and not by reading a job-success report.

Priorities From This Roundup

The pattern running through these fifteen stories is that almost none of them required an attacker to break a security control. They came in through channels your organization has already decided to trust: a package registry your developers pull from daily, a messaging app outside your mail gateway, a code-signing certificate that tells Windows the driver is fine, a remote access product your helpdesk may already use. Your email filtering and your endpoint agent are not failing in these cases. They are being routed around.

That shifts where the real work sits. The controls that matter most are the ones governing what software is allowed to run and who is allowed to install it, and those are inventory and policy problems before they are tooling problems. If you cannot name every remote access agent running in your environment, or list which editor extensions and package sources your developers draw from, you are missing the visibility these campaigns depend on.

For most organizations the highest-value action coming out of this roundup is an audit of unsanctioned remote access tooling and developer extensions. Decide which remote support products are approved in your environment and treat any other instance as an incident until proven otherwise. Do the same for the marketplaces and registries your build pipeline trusts. It is unglamorous work, and it addresses the single assumption every story here exploited, which is that software arriving through a familiar channel has already been vetted by someone. Start with the inventory, and let what you find set the order of everything else.